Minecraft(AuthMe Reloaded) Hash

Technical details, regex signatures, and cracking commands for the Minecraft(AuthMe Reloaded) algorithm.

Regex Identification Signature:

                        ^\$sha\$[a-z0-9]{1,16}\$([a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128}|[a-f0-9]{140})$
                    

Hashcat Command (Mode: 20711):

Not supported natively by John the Ripper

← Back to Hash Identifier

What is Minecraft(AuthMe Reloaded)?

The **Minecraft AuthMe Reloaded (AMR) hash format** originates from the *AuthMe Reloaded* plugin for Minecraft servers, a popular tool for handling user authentication and permissions. This format is a **custom password hash scheme** designed to store user credentials in a MySQL-compatible format, combining a **SHA-1-based salted hash** with a **custom prefix structure**. The primary use-case is lightweight server-side authentication, where usernames and hashed passwords are stored in a database, and verification is performed by recomputing the hash with the provided password and comparing it to the stored value. The format typically follows a **`{AMR}$$`** structure, where `` is a 16-character hexadecimal string (128 bits) and `` is the SHA-1 digest (20 bytes) of the concatenated salt and password, encoded in hexadecimal. Unlike standard password hashes, AMR lacks iterative hashing (e.g., PBKDF2 or bcrypt) and relies solely on SHA-1, making it susceptible to brute-force and rainbow table attacks.

The **vulnerabilities of the AMR hash format stem from fundamental cryptographic weaknesses**. The absence of **salting in a secure manner** (while a salt is present, it is often weak or predictable) allows attackers to precompute hashes via **rainbow tables** or **dictionary attacks** if passwords are reused across systems. The reliance on **SHA-1**—a cryptographically broken hash function vulnerable to collision attacks—further compromises integrity, as modern GPU/CPU optimizations (e.g., CUDA-accelerated brute-forcers like Hashcat) can crack hashes at **millions of attempts per second**. Additionally, the **lack of iteration or work factor** (unlike bcrypt or Argon2) enables **offline brute-force attacks** to be executed efficiently, even on modest hardware. The format’s simplicity also makes it prone to **stolen credential reuse**, as the hashes can be easily reverse-engineered once extracted from the database.

Identifying Minecraft(AuthMe Reloaded) Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify Minecraft(AuthMe Reloaded), security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack Minecraft(AuthMe Reloaded)

If you need to recover the plaintext password for a Minecraft(AuthMe Reloaded) hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.